v3.1.36

Two high-value recall rules (436 → 438):

• JWT verification bypass: flags jwt.decode() of a request token used without a real signature check, and jwt.verify(..., { algorithms: ['none'] }) — while allowing the legitimate decode-then-verify pattern
• DOM XSS via jQuery .html()/.append()/.prepend() with user-controlled or concatenated content
  Both validated against a real-world corpus with zero false positives; the ReDoS rule-pattern guard now re-measures over-budget patterns to avoid load-induced flakiness